ISO 27090, security for AI systems
Guidance on the security threats facing AI systems and how to reduce them. Published in 2026.
Official sources
Use these official places to read the text and find the latest version.
Official website
The ISO page shows the stage, scope and a sample of the published standard.
Visit iso.org (ISO/IEC 27090) ↗Get the document
Sold by ISO and national standards bodies. ISO lists the PDF and ePub at CHF 204 at the time of writing.
Open the official page ↗What ISO 27090 is
ISO/IEC 27090 gives guidance on security threats to AI systems, such as tampered training data, stolen models and attacks that trick a model into wrong answers. It also suggests ways to reduce them.
It builds on the ISO 27000 family of security standards and adds what is different about AI, such as data poisoning and model theft. ISO says established cybersecurity practice still matters.
How ISO 27090 got to where it is today
The milestones that changed what organisations have to do.
ISO/IEC 27090:2026
Edition 1 is published in October 2026 by ISO/IEC JTC 1/SC 27. It runs to 56 pages and covers threats to AI systems across their life cycle.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You build or run AI models in production.
You use third-party AI services with company data.
Customers ask how your AI is secured.
You already follow ISO 27001 and want to cover AI.
What it asks of you
The requirements fall into six areas.
AI threats
Understand the new kinds of attack on AI systems.
Data security
Protect training and input data.
Model security
Protect the model itself from theft and tampering.
Supply chain
Check the models, tools and data you rely on.
Monitoring
Spot misuse and abnormal behaviour.
Incident handling
Respond when an AI system is attacked or misbehaves.
1 theme group, 2 areas and 6 outcomes
ISO/IEC 27090 is published (Edition 1, 2026-10) and gives guidance on AI specific security threats across the AI life cycle. Its clause structure has not been checked, so this page shows themes only.
2 areas · 6 outcomes
AI security themes (publication structure not checked)High level themes the standard covers, with no clause numbers claimed.2 areas · 6 outcomes
- T-assets
Identify AI assets that need protection such as training data and models.
What you do
- List data, models, prompts and pipelines
- T-attacks
Understand AI specific attacks such as data poisoning, evasion and model theft.
What you do
- Map attacks to your systems
- T-impact
Link threats to their potential impact.
What you do
- Rate impact per system
Evidence to keep
- AI threat model
- Asset list of data and models
- T-detect
Plan how to detect AI attacks and compromise.
What you do
- Monitor inputs, outputs and model behaviour
- T-mitigate
Select measures that reduce AI specific risks while using established security practices.
What you do
- Protect training data and restrict model access
- T-update
Secure model updates and retraining.
What you do
- Review and test data and models before release
Evidence to keep
- Control mapping to ISO 27001 and 27002
- Monitoring records
Nothing matches. Clear the search or pick another theme.
Outcomes and implementation examples are from ISO/IEC 27090:2026 Cybersecurity, AI, Addressing security threats and compromises to AI systems, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
List your AI systems
What you run, buy and use.
- 2
Map the threats
Which attacks matter for each system.
- 3
Choose safeguards
Link each threat to a control.
- 4
Test and monitor
Check that the safeguards work.
- 5
Review as threats change
Update as AI threats and the standard evolve.
How Optimus AI helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus AI |
|---|---|
| AI threats | AI threat library |
| Data security | Data controls and evidence |
| Model security | Model inventory with controls |
| Supply chain | Vendor and model register |
| Monitoring | Monitoring tasks and alerts |
| Incident handling | AI incident playbooks |
Free ISO 27090 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- AI system inventory
- AI threat assessment worksheet
- Vendor AI questionnaire
- AI incident checklist
Share or cite this page
Writing about ISO 27090? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-27090/">ISO 27090 explained in plain English - Optimus CyberX</a>Common questions
Is ISO 27090 published?
Yes. ISO/IEC 27090:2026 was published in October 2026 as edition 1.
Can we be certified to it?
No. It gives guidance. Certification is through ISO 27001 or ISO 42001.
How does it relate to ISO 42001?
ISO 42001 is a management system for AI. ISO 27090 focuses on AI security threats.
Do we have to wait for the final text?
No longer. The standard is published, and the same threat-first approach applies.
Related frameworks
See how ready you are for ISO 27090
Answer questions across every area. We email you a report showing where you comply and where you do not.